Method, device and equipment for identifying plaintext password interface and storage medium

Abstract

The invention relates to the field of data processing, and provides a plaintext password interface identification method and device, equipment and a storage medium, and the method comprises the steps: identifying a field contained in each interface for a plurality of interfaces contained in network traffic through an authentication interface rule base, determining an authentication interface, and extracting the network traffic of a preset duration; acquiring an authentication interface URL list, intercepting data traffic, detecting the data traffic through a trained AI model, if a detection result is a plaintext, reserving parameters of a plaintext authentication request, re-sending the plaintext authentication request to a service party for multiple times based on the parameters of the plaintext authentication request for replay verification, and if the plaintext authentication request is successfully sent, returning the plaintext authentication request to the service party. And if the received data returned by the system is consistent with the original plaintext authentication request feedback data and contains a successful status code, verifying that the authentication request is valid, determining that the replay verification is successful, and identifying that the authentication interface is in plaintext password transmission, thereby realizing the automatic detection of the plaintext password and detecting the security of the authentication interface.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a method, device, computer equipment and computer-readable storage medium for identifying a plaintext password interface. Background Art

[0002] Currently, many types of businesses interact with each other through interfaces, and there is a need for interface connection. Sensitive information should not be sent in plain text. Usually, after verification, the browser will switch to a secure connection. Attackers can hack into accounts by sniffing the login information and other information collected. A good web application always uses encryption to transmit sensitive information. The system generally has users and passwords. Users log in and transmit passwords to the backend. It is easy to be captured and stolen during plain text transmission.

[0003] To ensure secure communication of interface connections, it is necessary to ensure that the authentication method is confidential and reliable. However, some businesses may use insecure communication methods, which may cause problems with plain text password transmission.

[0004] How to ensure the reliability of password authentication methods generally relies on manual coding control in the development stage, but manual methods are prone to omissions. Therefore, how to identify situations where insecure communication methods are used to ensure the reliability of password authentication methods is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The main purpose of the present invention is to provide a method, device, equipment and computer-readable storage medium for plain text password interface identification, aiming to solve the technical problem that the reliability of password authentication methods cannot be ensured in the current situation where unsafe communication methods are often used.

[0006] To achieve the above object, the present invention provides a method for plain text password interface identification, the method for plain text password interface identification comprising the following steps:

[0007] For multiple interfaces included in the network traffic, the fields included in each interface are identified through the authentication interface rule base to determine the authentication interface;

[0008] Extract network traffic of a preset duration, obtain the authentication interface URL list, intercept data traffic and perform detection through the trained AI model to obtain detection results;

[0009] If the detection result is plain text, the parameters of the plain text authentication request are retained, and the plain text authentication request is resent to the service provider for multiple times for replay verification based on the parameters of the plain text authentication request, where the parameters of the plain text authentication request include the destination address, request body, protocol type, and header information;

[0010] If the plaintext authentication request is sent successfully, and the data returned by the system is consistent with the original plaintext authentication request feedback data and contains a successful status code, then the authentication request is verified to be valid, and the replay verification is determined to be successful, then the authentication interface is identified as plaintext password transmission.

[0011] In addition, to achieve the above-mentioned purpose, the present invention also provides a device for plain text password interface identification, the device for plain text password interface identification comprising:

[0012] The determination module identifies the fields contained in each interface through the authentication interface rule base for multiple interfaces contained in the network traffic, and determines the authentication interface;

[0013] A detection module is used to extract network traffic of a preset duration, obtain the authentication interface URL list, intercept data traffic, perform detection through a trained AI model, and obtain detection results;

[0014] A verification module, for retaining the parameters of the plain text authentication request if the detection result is plain text, and resending the plain text authentication request to the service provider for multiple times for replay verification based on the parameters of the plain text authentication request, wherein the parameters of the plain text authentication request include a destination address, a request body, a protocol type, and header information;

[0015] The identification module is used to verify that the authentication request is valid if the plaintext authentication request is sent successfully, and the data returned by the system is consistent with the original plaintext authentication request feedback data and contains a successful status code. If the replay verification is successful, the authentication interface is identified as plaintext password transmission.

[0016] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer device, which includes a processor, a memory, and a program for plaintext password interface identification stored in the memory and executable by the processor, wherein when the program for plaintext password interface identification is executed by the processor, the steps of the method for plaintext password interface identification as described above are implemented.

[0017] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which a program for plaintext password interface identification is stored, wherein when the program for plaintext password interface identification is executed by a processor, the steps of the method for plaintext password interface identification as described above are implemented.

[0018] The present application provides a method for identifying a plaintext password interface, wherein the method determines the authentication interface by identifying the fields contained in each interface through the authentication interface rule base for multiple interfaces contained in the network traffic; extracting the network traffic of a preset duration, obtaining the authentication interface URL list, intercepting the data traffic and detecting it through the trained AI model to obtain the detection result; if the detection result is plaintext, the parameters of the plaintext authentication request are retained, and the plaintext authentication request is resent to the service party for replay verification based on the parameters of the plaintext authentication request for multiple times, and the parameters of the plaintext authentication request include the destination address, request body, protocol type, and header information; if the plaintext authentication request is sent successfully, the data returned by the system is consistent with the original plaintext authentication request feedback data, and contains a successful status code, then the authentication request is verified to be valid, and the replay verification is determined to be successful, then the authentication interface is identified as plaintext password transmission, realizing automatic detection of plaintext passwords, and detecting the security of the authentication interface. In order to ensure the reliability of the business authentication method, a method of combining network traffic detection with replay request is proposed to identify the plaintext password, and data traffic detection is combined with traditional hacker replay attack methods to ensure the accuracy of identifying the plaintext password. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of a flow chart of a first embodiment of a method for plain text password interface identification according to the present invention;

[0020] Figure 2 A schematic diagram of a device for plain text password interface identification of the present invention;

[0021] Figure 3 The figure is a schematic diagram of the hardware structure of a computer device involved in an embodiment of the present invention.

[0022] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0024] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0025] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0026] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0027] The method for plain text password interface identification involved in the embodiment of the present invention is mainly applied to computer equipment. The generating device of the plain text password interface identification can be a PC, a portable computer, a mobile terminal or other equipment with display and processing functions.

[0028] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0029] Reference Figure 1 , Figure 1 This is a flow chart of the first embodiment of the method for plain text password interface identification of the present invention.

[0030] like Figure 1 As shown, an embodiment of the present invention provides a method for plain text password interface identification, and the method for plain text password interface identification includes steps S10 to S40.

[0031] In this embodiment, the method for identifying a plain text password interface includes the following steps:

[0032] Step S10: For multiple interfaces included in the network traffic, the fields included in each interface are identified through an authentication interface rule base to determine the authentication interface.

[0033] In a specific embodiment, the authentication interface rule base is used to identify which interfaces contain which fields and belong to the authentication interface. Network traffic contains a large number of requests and multiple interfaces. The network traffic will include authentication scenarios for entering account numbers and passwords, but how to determine whether the network traffic contains authentication scenarios is mainly confirmed by identifying the interface for login authentication. In this embodiment, the authentication interface rule base includes identifying the following fields: user field rule base, password rule base, and protocol field rule base.

[0034] Network traffic contains a large number of requests. A single request contains information such as request time, source address, destination address, request content, and request protocol. The authentication interface contains some special features. For example, the destination address contains Login, the request content contains user information and password information, and the request protocol includes HTTP, FTP and other protocols. An authentication interface feature library is formed based on these special features. Once a request contains the authentication interface feature library, it is considered to contain the authentication interface URL.

[0035] Extract network traffic of a certain length of time, filter it using a feature library, and export a list of authentication interface URLs (destination addresses) therein, thereby determining the authentication interface. In this embodiment, step S10 includes: for multiple interfaces included in the network traffic, identify the fields included in each interface through an authentication interface rule library to determine the authentication interface.

[0036] Step S20: extract network traffic of a preset duration, obtain the authentication interface URL list, intercept data traffic and perform detection through the trained AI model to obtain detection results.

[0037] It should be noted that after the authentication interface is determined, the traffic detection is performed on the relevant requests, the network traffic of a certain length is extracted, the authentication interface URL list is input, and the relevant traffic is intercepted. The traffic contains a single request information, and the single request information contains the request time, source address, destination address, request content, request protocol and other information. The intercepted relevant traffic is detected to obtain the detection result, which includes plain text or cipher text. When the relevant traffic detection meets the plain text feature in the password feature, the detection result is plain text; when the relevant traffic detection does not meet the plain text feature, the detection result is cipher text.

[0038] Furthermore, the password features include semantic features and / or special symbol features.

[0039] To establish password features, first establish basic features, including: total number of characters, number of letters, letter ratio, number of numbers, number ratio, and whether it is the number of common ciphertexts.

[0040] Password features include semantic features. Specifically, if it is a plain text password, it generally has semantics, which commonly include English, Pinyin, and date. Therefore, semantics are modeled, the text is segmented, and whether there are common semantic features such as English, Pinyin, and date. The specific calculation output includes the following:

[0041] Quantity: number of English words, number of Pinyin words, number of date words.

[0042] Proportion: the ratio of the number of English word characters to the total number of characters, the ratio of the number of Pinyin word characters to the total number of characters, and the ratio of the number of date word characters to the total number of characters.

[0043] Semantic proportion: the ratio of the number of semantic words (i.e. English, Pinyin, date) characters to the total number of characters, and the ratio of the number of non-semantic words characters to the total number of characters.

[0044] Password features also include special symbol features. Specifically, if it is a plain text password, it may contain various special symbols entered manually, while the special symbols contained in the ciphertext are generally relatively fixed, so this feature can be used to establish relevant features. The specific calculation output includes the following:

[0045] Quantity: number of special symbols, number of ciphertext special symbols, number of non-ciphertext special symbols.

[0046] Proportion: the ratio of the number of ciphertext special symbols to the total number of special symbols, the ratio of the number of non-ciphertext special symbols to the total number of special symbols.

[0047] Step S30: If the detection result is plain text, the parameters of the plain text authentication request are retained, and the plain text authentication request is resent to the service provider for multiple times for replay verification based on the parameters of the plain text authentication request, wherein the parameters of the plain text authentication request include the destination address, request body, protocol type, and header information.

[0048] In the specific implementation, if the interface is in plain text, replay verification is performed, for example, the request is replayed three times at an interval of 10 minutes. If the replay request is successful, it is verified that the authentication interface is a plain text password transmission. Replay verification means that the original request parameters are retained and the request is resent to the service provider. The request parameters refer to the destination address, request body (including account password), protocol type, header information, and resending.

[0049] For example, replaying an HTTP request means sending an already sent HTTP request again. The purpose of replaying an HTTP request is to re-execute the previous request in order to achieve the same effect. Replaying an HTTP request can achieve the following:

[0050] Data consistency: Data consistency needs to be ensured. By replaying previous HTTP requests, the same data operations can be executed again, thus maintaining data consistency.

[0051] Debugging and testing: During the development and testing process, replaying HTTP requests can help developers and testers reproduce problems, locate and fix bugs. By replaying requests, previous requests can be accurately simulated for debugging and testing.

[0052] Performance testing: Replaying HTTP requests can also be used for performance testing. By replaying a large number of requests, you can simulate and evaluate the performance of the system under high load conditions, so as to perform performance optimization and capacity planning.

[0053] Security assessment: Replaying HTTP requests can also be used for security assessment and vulnerability discovery. By replaying requests, you can try to reproduce previous security vulnerabilities in order to conduct security risk assessment and repair.

[0054] In summary, replaying HTTP requests is the act of repeatedly sending HTTP requests that have already been sent. Its significance lies in data consistency, debugging and testing, performance testing, and security assessment. In actual applications, you can choose appropriate methods and tools for replay operations based on specific needs and scenarios.

[0055] Step S40: If the plaintext authentication request is sent successfully, and the data returned by the system is consistent with the original plaintext authentication request feedback data and contains a successful status code, then the authentication request is verified to be valid, and the replay verification is determined to be successful, then the authentication interface is identified as plaintext password transmission.

[0056] It is understandable that if the sending is successful, the data returned by the system is consistent with the original plain text authentication request feedback data and contains a successful status code, then the authentication request is verified to be valid, and the authentication interface is identified as plain text password transmission. If the data returned by the system is inconsistent with the original plain text authentication request feedback data and does not contain a successful status code, the authentication interface is identified as cipher text password transmission.

[0057] Furthermore, after step S30, the method further includes:

[0058] If the data returned by the system is inconsistent with the original plaintext authentication request feedback data when the plaintext authentication request is sent successfully and does not contain a successful status code, the replay verification is deemed to have failed and the authentication interface is identified as encrypted password transmission.

[0059] Once the authentication interface is identified as a plain text password, the abnormal authentication interface will be sent to the relevant developers for rectification and optimization. Specifically: First, obtain the developer of the authentication interface, obtain the domain name in the authentication interface, query the system corresponding to the domain name in the enterprise management system, and then query the relevant developers. Second, send the plain text password to the developer for rectification, and require the rectification completion time, and record the estimated completion time. Third, supervise the implementation. If the same problem is found again within the rectification time, no supervision will be carried out. If the same problem is still found after the rectification time, supervision and implementation will be carried out.

[0060] In order to ensure the reliability of business authentication, a method combining network traffic detection with replay request is proposed to identify plaintext passwords. The data traffic detection is combined with the traditional hacker replay attack method to ensure the accuracy of identifying plaintext passwords.

[0061] In this embodiment, through the multiple interfaces included in the network traffic, the fields included in each interface are identified through the authentication interface rule library, the authentication interface is determined, the network traffic of the preset duration is extracted, the authentication interface URL list is obtained, the data traffic is intercepted and tested through the trained AI model to obtain the test result. If the test result is plain text, the parameters of the plain text authentication request are retained, and the plain text authentication request is resent to the service party for replay verification based on the parameters of the plain text authentication request. The parameters of the plain text authentication request include the destination address, request body, protocol type, and header information. If the plain text authentication request is sent successfully, the data returned by the system is consistent with the original plain text authentication request feedback data, and contains a successful status code, then the authentication request is verified to be valid, and the replay verification is determined to be successful. Then, the authentication interface is identified as plain text password transmission, and the automatic detection of the plain text password is realized, and the security of the authentication interface is detected. In order to ensure the reliability of the business authentication method, a method of combining network traffic detection with replay request is proposed to identify the plain text password, and the data traffic detection is combined with the traditional hacker replay attack method to ensure the accuracy of identifying the plain text password.

[0062] Continue to refer to Figure 1 Based on the above-mentioned first embodiment of the method for plain text password interface identification, a second embodiment of the method for plain text password interface identification of the present invention is proposed.

[0063] Based on the above Figure 1 In the embodiment shown, in this embodiment, before step S20, the following steps are further included:

[0064] Establishing basic password features, and establishing plaintext features and ciphertext features based on the basic password features;

[0065] Selecting a sample set according to the plaintext feature and the ciphertext feature;

[0066] The AI ​​model is trained according to the sample set to obtain a trained AI model.

[0067] It is understandable that before traffic detection, modeling work should be done first. Focus on modeling the password and feature training. Intercept data traffic, detect the data traffic through the trained AI model, and obtain the detection results.

[0068] Furthermore, in this embodiment, the establishing of the basic password features, and establishing the plaintext features and the ciphertext features based on the basic password features, includes:

[0069] Set the total number of characters, number of letters, letter ratio, number of numbers, number ratio, and whether it is a common ciphertext number to form the basic characteristics of the password;

[0070] Model the semantics, segment the text, determine whether it contains English, pinyin, or date, and construct semantic features;

[0071] Set the number of special symbols, the number of ciphertext special symbols, the number of non-ciphertext special symbols, the ratio of the number of ciphertext special symbols to the number of special symbols, and the ratio of the number of non-ciphertext special symbols to the number of special symbols to construct special symbol features;

[0072] Based on the basic features, semantic features and special symbol features of the password, plaintext features and ciphertext features are established.

[0073] It should be understood that password features include semantic features and / or special symbol features. To establish password features, first establish basic password features, including: total number of characters, number of letters, letter ratio, number of digits, digit ratio, and whether it is a common ciphertext number.

[0074] Furthermore, in this embodiment, the semantics is modeled, the text is segmented, whether it contains English, pinyin, and date, and semantic features are constructed, including:

[0075] Model the semantics, segment the text, and determine whether it contains English, pinyin, or dates;

[0076] If it contains English, Pinyin, and date, then set the number of English words, the number of Pinyin words, the number of date words, the ratio of the number of English word characters to the total number of characters, the ratio of the number of Pinyin word characters to the total number of characters, the ratio of the number of date word characters to the total number of characters, the ratio of the number of semantic word characters to the total number of characters, and the ratio of the number of non-semantic word characters to the total number of characters to construct semantic features.

[0077] It is understandable that password features include semantic features. Specifically, if it is a plain text password, it generally has semantics, which commonly include English, Pinyin, and date. Therefore, semantics are modeled, the text is segmented, and it is determined whether there are common semantic features such as English, Pinyin, and date. The specific calculation output includes the following:

[0078] Quantity: number of English words, number of Pinyin words, number of date words.

[0079] Proportion: the ratio of the number of English word characters to the total number of characters, the ratio of the number of Pinyin word characters to the total number of characters, and the ratio of the number of date word characters to the total number of characters.

[0080] Semantic proportion: the ratio of the number of semantic words (i.e. English, Pinyin, date) characters to the total number of characters, and the ratio of the number of non-semantic words characters to the total number of characters.

[0081] In this embodiment, the semantic features include: modeling semantics, segmenting the text, and determining whether it contains at least one semantic feature of English, pinyin, and date;

[0082] The special symbol characteristics include: the number and proportion of special symbols.

[0083] Password features also include special symbol features. Specifically, if it is a plain text password, it may contain various special symbols entered manually, while the special symbols contained in the ciphertext are generally relatively fixed, so this feature can be used to establish relevant features. The specific calculation output includes the following:

[0084] Quantity: number of special symbols, number of ciphertext special symbols, number of non-ciphertext special symbols.

[0085] Proportion: the ratio of the number of ciphertext special symbols to the total number of special symbols, the ratio of the number of non-ciphertext special symbols to the total number of special symbols.

[0086] Furthermore, in this embodiment, the semantic features include: modeling the semantics, segmenting the text, and determining whether it contains at least one semantic feature of English, pinyin, and date; the special symbol features include: the number and proportion of special symbols.

[0087] Furthermore, in this embodiment, after step S40, the following steps are further included:

[0088] The identified plaintext password is used as a new black sample, and the identified ciphertext password is used as a new white sample;

[0089] The trained AI model is retrained according to the new black samples and the new white samples.

[0090] In this embodiment, if the detection result is plain text, replay verification is performed. If the replay verification is successful, the authentication interface is identified as plain text password transmission.

[0091] If the replay request is successful, it verifies that the authentication interface is transmitting the plain text password, and it is automatically used as a black sample for subsequent model tuning. If it is unsuccessful, it will be recorded.

[0092] In the specific implementation, the commonly used encrypted ciphertext is selected as the white sample, and the plaintext password is selected as the black sample, and a sample set is constructed based on the white sample and the black sample. The AI ​​model is used to make logical judgments on the sample set, and the outputs 1 and 0 correspond to the plaintext and ciphertext respectively. Commonly used AI models, such as logistic regression and SVM, make logical judgments, input the training set for training, and obtain feature weights. Using the weights obtained from the above training, the sampling authentication interface establishes features and performs calculations, and outputs whether the authentication interface is plaintext or ciphertext.

[0093] Logical judgment means outputting 1 or 0 for plain text or cipher text, which is a function in the code. Take the training data (including the output results 1 or 0) and train it, and then get the weights of different features. Then use these feature weights to calculate the data again to see if the output result is 1 or 0.

[0094] In this embodiment, by establishing basic features of the password, establishing plaintext features and ciphertext features based on the basic features of the password, selecting a sample set according to the plaintext features and the ciphertext features, training the AI ​​model according to the sample set, obtaining a trained AI model, extracting network traffic of a preset duration, inputting the authentication interface URL list, intercepting data traffic, detecting the data traffic through the trained AI model, obtaining detection results, and proposing a method for extracting semantic features of plaintext passwords and ciphertext and non-ciphertext special symbol features, a method for identifying network traffic detection combined with a replay request, a method for automatically obtaining black samples by replaying requests, and automatically improving the model. The plaintext password traffic detection method can supervise the encoding link to ensure the reliability of the password authentication method.

[0095] See also Figure 2 , Figure 2 It is a functional module diagram of a device for plain text password interface identification provided in an embodiment of the present application.

[0096] like Figure 2 As shown, the device 200 for identifying a plain text password interface includes:

[0097] The determination module 10 identifies the fields included in each interface through the authentication interface rule base for multiple interfaces included in the network traffic, and determines the authentication interface;

[0098] The detection module 20 is used to extract the network traffic of a preset time, obtain the authentication interface URL list, intercept the data traffic and perform detection through the trained AI model to obtain the detection result;

[0099] A verification module 30, for retaining the parameters of the plain text authentication request if the detection result is plain text, and re-sending the plain text authentication request to the service provider for multiple times for replay verification based on the parameters of the plain text authentication request, wherein the parameters of the plain text authentication request include a destination address, a request body, a protocol type, and header information;

[0100] The identification module 40 is used to verify that the authentication request is valid if the plain text authentication request is sent successfully, and the data returned by the system is consistent with the original plain text authentication request feedback data and contains a successful status code, and the replay verification is determined to be successful, and then the authentication interface is identified as plain text password transmission.

[0101] The authentication interface rule base includes identifying the following fields: user field rule base, password rule base, and protocol field rule base.

[0102] Furthermore, the device 200 for identifying a plain text password interface further includes:

[0103] An establishing module, used for establishing basic password characteristics, and establishing plaintext characteristics and ciphertext characteristics based on the basic password characteristics;

[0104] A selection module, used for selecting a sample set according to the plaintext feature and the ciphertext feature;

[0105] The training module is used to train the AI ​​model according to the sample set to obtain a trained AI model.

[0106] Furthermore, the establishment module is also used to set the total number of characters, the number of letters, the percentage of letters, the number of numbers, the percentage of numbers, and whether it is a common ciphertext number, to constitute the basic characteristics of the password;

[0107] Model the semantics, segment the text, determine whether it contains English, pinyin, or date, and construct semantic features;

[0108] Set the number of special symbols, the number of ciphertext special symbols, the number of non-ciphertext special symbols, the ratio of the number of ciphertext special symbols to the number of special symbols, and the ratio of the number of non-ciphertext special symbols to the number of special symbols to construct special symbol features;

[0109] Based on the basic features, semantic features and special symbol features of the password, plaintext features and ciphertext features are established.

[0110] Furthermore, the establishment module is also used to model semantics, segment text, and determine whether it contains English, pinyin, and date;

[0111] If it contains English, Pinyin, and date, then set the number of English words, the number of Pinyin words, the number of date words, the ratio of the number of English word characters to the total number of characters, the ratio of the number of Pinyin word characters to the total number of characters, the ratio of the number of date word characters to the total number of characters, the ratio of the number of semantic word characters to the total number of characters, and the ratio of the number of non-semantic word characters to the total number of characters to construct semantic features.

[0112] The identification module 40 is also used to determine that the replay verification has failed and identify the authentication interface as ciphertext password transmission if the data returned by the system is inconsistent with the original plaintext authentication request feedback data and does not contain a successful status code when the plaintext authentication request is sent successfully.

[0113] The training module is also used to use the recognized plaintext password as a new black sample and the recognized ciphertext password as a new white sample; and re-train the trained AI model based on the new black sample and the new white sample.

[0114] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and each module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0115] The above-mentioned device can be implemented in the form of a computer program. Figure 3 Runs on the computer device shown.

[0116] See also Figure 3 , Figure 3 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device may be a server.

[0117] See also Figure 3 The computer device includes a processor, a memory and a network interface connected through a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.

[0118] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any method of plain text password interface identification.

[0119] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0120] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any method of plain text password interface recognition.

[0121] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0123] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0124] For multiple interfaces included in the network traffic, the fields included in each interface are identified through the authentication interface rule base to determine the authentication interface;

[0125] Extract network traffic of a preset duration, obtain the authentication interface URL list, intercept data traffic and perform detection through the trained AI model to obtain detection results;

[0126] If the detection result is plain text, the parameters of the plain text authentication request are retained, and the plain text authentication request is resent to the service provider for multiple times for replay verification based on the parameters of the plain text authentication request, where the parameters of the plain text authentication request include the destination address, request body, protocol type, and header information;

[0127] If the plaintext authentication request is sent successfully, and the data returned by the system is consistent with the original plaintext authentication request feedback data and contains a successful status code, then the authentication request is verified to be valid, and the replay verification is determined to be successful, then the authentication interface is identified as plaintext password transmission.

[0128] A computer-readable storage medium is also provided in an embodiment of the present application, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and the processor executes the program instructions to implement any one of the methods for plaintext password interface identification provided in the embodiments of the present application.

[0129] In one embodiment, the processor executes the program instructions to implement the following steps:

[0130] For multiple interfaces included in the network traffic, the fields included in each interface are identified through the authentication interface rule base to determine the authentication interface;

[0131] Extract network traffic of a preset duration, obtain the authentication interface URL list, intercept data traffic and perform detection through the trained AI model to obtain detection results;

[0132] If the detection result is plain text, the parameters of the plain text authentication request are retained, and the plain text authentication request is resent to the service provider for multiple times for replay verification based on the parameters of the plain text authentication request, where the parameters of the plain text authentication request include the destination address, request body, protocol type, and header information;

[0133] If the plaintext authentication request is sent successfully, and the data returned by the system is consistent with the original plaintext authentication request feedback data and contains a successful status code, then the authentication request is verified to be valid, and the replay verification is determined to be successful, then the authentication interface is identified as plaintext password transmission.

[0134] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0135] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for identifying a plain text password interface, characterized in that: The method for plain text password interface identification comprises the following steps: For multiple interfaces included in the network traffic, the fields included in each interface are identified through the authentication interface rule base to determine the authentication interface; Extract network traffic of a preset duration, obtain the authentication interface URL list, intercept data traffic and perform detection through the trained AI model to obtain detection results; If the detection result is plain text, the parameters of the plain text authentication request are retained, and the plain text authentication request is resent to the service provider for multiple times for replay verification based on the parameters of the plain text authentication request, where the parameters of the plain text authentication request include the destination address, request body, protocol type, and header information; If the plaintext authentication request is sent successfully, and the data returned by the system is consistent with the original plaintext authentication request feedback data and contains a successful status code, then the authentication request is verified to be valid, and if the replay verification is successful, the authentication interface is identified as plaintext password transmission.

2. The method for plain text password interface identification as claimed in claim 1, characterized in that: The authentication interface rule base includes identifying the following fields: user field rule base, password rule base, and protocol field rule base.

3. The method for plain text password interface identification as claimed in claim 1, characterized in that: The extracting of network traffic of a preset duration, obtaining the authentication interface URL list, intercepting data traffic for detection through a trained AI model, and obtaining the detection result also include: Establishing basic password features, and establishing plaintext features and ciphertext features based on the basic password features; Selecting a sample set according to the plaintext feature and the ciphertext feature; The AI ​​model is trained according to the sample set to obtain a trained AI model.

4. The method for plain text password interface identification as claimed in claim 3, characterized in that: The establishing of the basic password features, establishing the plaintext features and the ciphertext features based on the basic password features, includes: Set the total number of characters, number of letters, letter ratio, number of numbers, number ratio, and whether it is a common ciphertext number to form the basic characteristics of the password; Model the semantics, segment the text, determine whether it contains English, pinyin, or date, and construct semantic features; Set the number of special symbols, the number of ciphertext special symbols, the number of non-ciphertext special symbols, the ratio of the number of ciphertext special symbols to the number of special symbols, and the ratio of the number of non-ciphertext special symbols to the number of special symbols to construct special symbol features; Based on the basic features, semantic features and special symbol features of the password, plaintext features and ciphertext features are established.

5. The method for plain text password interface identification as claimed in claim 4, characterized in that: The semantics modeling is performed, the text is segmented, whether it contains English, pinyin, and date, and semantic features are constructed, including: Model the semantics, segment the text, and determine whether it contains English, pinyin, or dates; If it contains English, Pinyin, and date, then set the number of English words, the number of Pinyin words, the number of date words, the ratio of the number of English word characters to the total number of characters, the ratio of the number of Pinyin word characters to the total number of characters, the ratio of the number of date word characters to the total number of characters, the ratio of the number of semantic word characters to the total number of characters, and the ratio of the number of non-semantic word characters to the total number of characters to construct semantic features.

6. The method for plain text password interface identification as claimed in claim 1, characterized in that: If the detection result is plain text, the parameters of the plain text authentication request are retained, and after the plain text authentication request is resent to the service party for multiple times for replay verification based on the parameters of the plain text authentication request, the method further includes: If the data returned by the system is inconsistent with the original plaintext authentication request feedback data when the plaintext authentication request is sent successfully and does not contain a successful status code, the replay verification is deemed to have failed and the authentication interface is identified as encrypted password transmission.

7. The method for plain text password interface identification as claimed in claim 6, characterized in that: If the plain text authentication request is sent successfully, the data returned by the system is consistent with the original plain text authentication request feedback data and contains a successful status code, then the authentication request is verified to be valid, and the replay verification is determined to be successful. After identifying that the authentication interface is plain text password transmission, it also includes: The identified plaintext password is used as a new black sample, and the identified ciphertext password is used as a new white sample; The trained AI model is retrained according to the new black samples and the new white samples.

8. A device for plain text password interface identification, characterized in that: The device for identifying the plain text password interface includes: The determination module identifies the fields contained in each interface through the authentication interface rule base for multiple interfaces contained in the network traffic, and determines the authentication interface; A detection module is used to extract network traffic of a preset duration, obtain the authentication interface URL list, intercept data traffic, perform detection through a trained AI model, and obtain detection results; A verification module, for retaining the parameters of the plain text authentication request if the detection result is plain text, and resending the plain text authentication request to the service provider for multiple times for replay verification based on the parameters of the plain text authentication request, wherein the parameters of the plain text authentication request include a destination address, a request body, a protocol type, and header information; The identification module is used to verify that the authentication request is valid if the plaintext authentication request is sent successfully, and the data returned by the system is consistent with the original plaintext authentication request feedback data and contains a successful status code. If the replay verification is successful, the authentication interface is identified as plaintext password transmission.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a program for plaintext password interface identification stored in the memory and executable by the processor, wherein when the program for plaintext password interface identification is executed by the processor, the steps of the method for plaintext password interface identification as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program for plaintext password interface identification, wherein when the program for plaintext password interface identification is executed by a processor, the steps of the method for plaintext password interface identification as claimed in any one of claims 1 to 7 are implemented.

Images